A counterparty has sent a two-page mutual confidentiality agreement ahead of a first meeting, and the cover email says "standard form, no changes needed". You have ten minutes before the call and a draft that looks fine at a glance. The risk is not that it is grossly unfair — most of these are not. The risk is that the definition of confidential information is too narrow to cover the conversation you are about to have, the term is too short to outlast the deal it precedes, and the remedies clause assumes you would sue in a state you would never choose.
A mutual confidentiality agreement (sometimes called a mutual NDA) binds two parties to keep each other's confidential information secret, to use it only for an agreed purpose, and to return or destroy it when the relationship ends. It sits before the substantive deal — heads of agreement, term sheet, shareholders agreement, supply contract — and is replaced (or absorbed) by the confidentiality clauses in that later document. It supplements, rather than replaces, the equitable duty of confidence recognised in Coco v AN Clark (Engineers) Ltd [1969] RPC 41, which protects information that has the necessary quality of confidence, was imparted in circumstances importing an obligation, and is then misused. The contract tightens the proof position and adds remedies; it does not create the underlying right.
What "confidential information" actually means in the document
The definition is the clause that decides every dispute. Drafted narrowly, half the conversation you are about to have falls outside it. Drafted too broadly, a court may read it down or refuse to enforce it.
A workable definition catches three things: information marked or identified as confidential at the time of disclosure; information that a reasonable person in the recipient's position would understand to be confidential from its nature or the circumstances; and the existence and terms of the discussions themselves. The third limb is the one most often missing from template forms.
Common drafting choices to look for:
- Whether oral and visual disclosures are captured (templates often require oral disclosures to be reduced to writing within a fixed period, commonly 30 days — a trap if neither side will remember to do it).
- Whether the definition extends to derivatives — notes, analyses, summaries, and models built from the disclosed information. These are usually where the commercial value sits.
- Whether trade secrets are called out separately, with a longer or indefinite confidentiality period.
Push back where the definition is limited to information stamped "Confidential". Most real-world conversations do not work that way.
Carve-outs from the definition
Every confidentiality agreement carves out four categories of information that cannot, by their nature, be confidential between the parties: information already in the public domain; information the recipient already knew before disclosure; information the recipient independently developed; and information lawfully received from a third party without a duty of confidence. These are uncontroversial and should be in every draft. Two drafting points:
- The recipient should bear the burden of proving a carve-out applies, with contemporaneous records — not the discloser proving it does not.
- "Public domain" should mean publicly available without breach by the recipient, not merely "available to someone, somewhere".
Permitted purpose
The permitted purpose clause limits what the recipient can do with the information, regardless of confidentiality. If the purpose is "to evaluate a potential transaction between the parties", use of the information for any other deal — including with a competitor of the discloser — is a breach even if the information stays inside the recipient's organisation.
Keep the purpose specific. A clause that permits use "for any business purpose" gives the document away. Where the recipient is a corporate group, name the entities (or class of entities) within the group that may receive the information, and require them to be bound by equivalent obligations before disclosure.
Permitted disclosures to representatives
The recipient will need to share the information with its own people — directors, employees, accountants, lawyers, financiers, prospective investors. A workable clause:
- Defines "representatives" by reference to a need-to-know test, not by job title alone.
- Requires the recipient to ensure each representative is informed of the confidentiality obligations and to remain responsible for their breaches.
- Lists professional advisers separately, often without the need-to-know gate, because lawyers and accountants are already bound by their own duties.
The trap is the clause that lets the recipient disclose to "affiliates" without defining the term. "Affiliate" in international precedents often catches every entity under common control — which can include a competitor of the discloser.
Compelled disclosure
A recipient who is served with a subpoena, statutory notice, or court order must be free to comply without breaching the agreement. The standard clause permits disclosure to the extent legally required, on condition that the recipient:
- Notifies the discloser as soon as practicable (and before disclosure if lawfully able);
- Cooperates with any application by the discloser to limit or resist the disclosure; and
- Discloses only the minimum required.
ASX-listed parties will sometimes add disclosure to comply with continuous disclosure obligations. Regulated parties may add disclosure to APRA, ASIC, or the ATO. These are reasonable; check that the notification step is still preserved.
Term and survival
A mutual confidentiality agreement has two clocks: how long the obligations apply to information disclosed during the term, and how long the term itself runs.
Common shapes:
- Term of 1-3 years from execution, with confidentiality obligations surviving for a further 3-5 years from disclosure.
- Indefinite confidentiality for trade secrets, fixed period for everything else.
- Confidentiality tied to the underlying transaction — surviving termination of the deal it preceded.
The mistake is matching the survival period to the term. A 12-month agreement with 12-month survival means information disclosed in month 11 is protected for only one more month after the relationship ends. For most commercial discussions, survival should run from the date of disclosure, not the date of the agreement.
Return or destruction
At the end of the relationship, each party should be obliged to return or destroy the other's confidential information on request, and to certify in writing that it has done so. Two drafting choices that matter:
- A backup-and-archive carve-out is standard and reasonable — IT systems cannot selectively delete from backups. The carve-out should continue the confidentiality obligation for as long as the archived copy exists.
- Board papers, legal advice, and records the recipient is required to keep under law (corporate records, tax records under the Income Tax Assessment Act 1997 (Cth), professional file-retention rules) should be expressly preserved.
Remedies and equitable relief
Damages alone rarely fix a confidentiality breach — the information is out. The clause should expressly acknowledge that damages may be inadequate and that the discloser is entitled to seek injunctive relief without proving loss. Australian courts will grant equitable relief in appropriate cases without this clause, but the acknowledgement removes one argument from the breaching party's playbook.
Watch for liquidated damages figures dropped into Australian templates from US precedents. A figure that is not a genuine pre-estimate of loss is a penalty and unenforceable.
Governing law and jurisdiction
For two Australian businesses, this should be the law and courts of one Australian state — usually the state where the discloser has its registered office, or the state where the deal will be performed. Exclusive jurisdiction is preferable to non-exclusive; it stops a counterparty filing in a forum that suits them better when a dispute arises.
For a cross-border arrangement, expect a fight. The discloser usually wants its home jurisdiction. A negotiated middle is a neutral seat (Singapore, Hong Kong) with arbitration under a recognised set of rules, particularly where injunctive relief can be obtained in the courts of either party's home jurisdiction in parallel.
Optional and situational clauses
These are not in every mutual confidentiality agreement, but each is worth including when the trigger is present:
- No-poach — restricts each party from soliciting the other's employees during the term and for a defined period after. Include where the discussions will expose key personnel.
- No-shop or exclusivity — restricts the discloser from negotiating with other parties during a defined window. Include where a transaction is genuinely on the table and the recipient is doing real work.
- Residuals clause — allows the recipient's people to use information retained in unaided memory. Common in software and consulting deals; dangerous for trade-secret-heavy disclosures.
- Standstill — restricts the recipient from acquiring shares or making takeover offers for the discloser. Include for any discussion involving a listed entity or a control transaction.
- Personal information overlap — where the disclosed information includes personal information regulated by the Privacy Act 1988 (Cth), add a clause requiring the recipient to handle it in accordance with the Australian Privacy Principles, regardless of whether the recipient is otherwise an APP entity.
How Artificer Legal reviews and negotiates a mutual confidentiality agreement
When a client sends us a counterparty's template, we work through the document in commercial order rather than clause order. We start with the definition of confidential information and the permitted purpose, because every other clause depends on them. We then move to term and survival, because a well-drafted obligation that expires too early is the same as no obligation.
We push back hardest on three points: a definition that requires written marking for oral disclosures, a permitted-purpose clause that drifts into "any business purpose", and an "affiliates" disclosure right with no definition of the term. We insist on representative-level responsibility (recipient remains liable for its people), a compelled-disclosure notification step, and survival of confidentiality obligations running from the date of disclosure rather than the date of the agreement.
Where the document precedes a larger transaction, we draft the confidentiality clauses in the substantive contract to absorb the mutual confidentiality agreement on execution, so the parties are not left arguing about which document governs.
The survival period
The clause most often skipped — or drafted on autopilot — is the survival period. Parties focus on the term of the agreement and forget that the question in any real dispute is whether information disclosed two years ago is still protected today. A mutual confidentiality agreement with a 12-month term and a 12-month survival is, in practice, a document that protects a conversation for the year you are having it. For anything that matters, the survival clock should start when the information is shared and should run long enough that the commercial sensitivity of that specific information has plausibly faded.
The rest of the document is scaffolding around four decisions: what counts as confidential, what the recipient may do with it, how long the obligation lasts, and what happens when it is breached. Get the definition wide enough to cover the conversation you are about to have, tie the permitted purpose to the specific deal on the table, set the survival from disclosure rather than from execution, and preserve the right to injunctive relief without proving loss. The optional clauses — no-poach, standstill, residuals, privacy overlay — are situational, and the governing-law clause matters more for cross-border arrangements than for two Australian businesses. A mutual confidentiality agreement that gets the four core decisions right is doing its job before anyone reaches for it.